# EventSub returning 403 with token using proper scope

**URL:** <https://staging-discuss.dev.twitch.com/t/eventsub-returning-403-with-token-using-proper-scope/36119>\
**Category:** API\
**Created:** [January 11, 2022, 2:10am UTC](https://staging-discuss.dev.twitch.com/t/eventsub-returning-403-with-token-using-proper-scope/36119 "2022-01-11T02:10:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hfrarfhf](https://avatars.discourse-cdn.com/v4/letter/h/59ef9b/32.png) [@hfrarfhf](https://staging-discuss.dev.twitch.com/u/hfrarfhf)\
**Post date:** [January 11, 2022, 2:10am UTC](https://staging-discuss.dev.twitch.com/t/eventsub-returning-403-with-token-using-proper-scope/36119/1 "2022-01-11T02:10:01Z")

</div>

Hello,

I’m trying to register a `channel.cheer` EventSub subscription. This is the request I’m making to retrieve the OAuth token:

```auto
curl -X POST \
    -F 'client_id=[redacted]' \
    -F 'client_secret=[redacted]' \
    -F 'grant_type=client_credentials' \
    -F 'scope=user:read:email bits:read channel:read:hype_train channel:manage:broadcast channel:manage:redemptions' \
    https://id.twitch.tv/oauth2/token

```

Then I am using the token in that request’s response here:

```auto
curl -X POST 'https://api.twitch.tv/helix/eventsub/subscriptions' \
    -H 'Authorization: Bearer [redacted]' \
    -H 'Client-Id: [redacted]' \
    -H 'Content-Type: application/json' \
    -d '{"type":"channel.cheer","version":"1","condition":{"broadcaster_user_id":"468236963"},"transport":{"method":"webhook","callback":"https://[redacted]/","secret":"[redacted]"}}'

```

Which is responding with:

```auto
{"error":"Forbidden","status":403,"message":"subscription missing proper authorization"}

```

The docs say that only the `bits:read` scope is required, so I’m confused.

I also tried using only `bits.read` for the scope and nothing else, even though I needed those other scopes to register other subscriptions, and I still was unable to register a `channel.cheer` event sub.

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d1d6mrmdu7ztse.cloudfront.net/user_avatar/staging-discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://staging-discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [January 11, 2022, 2:45am UTC](https://staging-discuss.dev.twitch.com/t/eventsub-returning-403-with-token-using-proper-scope/36119/2 "2022-01-11T02:45:49Z")

</div>

Eventsub uses an App Access Token.  
An App access token cannot have scopes, not does it represent a user.  
You need to do a user oAuth Loop first with the needed scopes.  
Discard/ignore that token (or use it for data catch up)  
Then create topics using the app access token (again with no scopes)

Further reading [How does Twitch’s new EventSub work? – Barry Carlyon](https://barrycarlyon.co.uk/wordpress/2021/02/03/how-does-twitchs-new-eventsub-work/)

So in summary your clientID doesn’t have access to read cheer information for `468236963` as you didn’t do a user oAuth loop first.

EventSub works by creating a link between clientID and user. (via user oAuth)  
Then you can use the app access token to create subscriptions to topics

---

<div class="post-metadata">

**Author:** ![system](https://d2spem0quai2ol.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://staging-discuss.dev.twitch.com/u/system)\
**Post date:** [February 10, 2022, 2:46am UTC](https://staging-discuss.dev.twitch.com/t/eventsub-returning-403-with-token-using-proper-scope/36119/3 "2022-02-10T02:46:26Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.